assuming that `$username` never *begins* with "@"